Online GDPR Awareness Training

25.00+ VAT

GDPR Training Online

4.6 (138 reviews)

Unlimited Resits Customer Support Instant Access

£25.00 +VAT per person

Course information

Certificate on Successful Completion
Access course on Desktop, Laptop or Tablet
15 Multiple Choice Questions
Course Duration: 45 Minutes
CPD Points: 1

This online GDPR Awareness course provides employees with the knowledge they need to understand their data protection responsibilities in the workplace. Learners will explore what constitutes personal data, including special category data, and learn about the seven core principles of the UK General Data Protection Regulation (UK GDPR) that underpin the processing of personal data.

The training also explains the seven lawful bases for processing personal data, including consent and performance of a contract. This helps learners understand not only the requirements of UK data protection law but also how they apply in practical workplace situations.

With human error identified by the Information Commissioner’s Office (ICO) as the leading cause of reported data breaches, providing staff with effective GDPR training can help organisations improve compliance, strengthen data handling practices and reduce the risk of personal data breaches.

Train online at your own pace with a full audio voiceover
Accredited by CPD
Certificate on successful completion
Course duration: 45 minutes
Unlimited resits at no cost

Discounts on Bulk Purchases

Take advantage of our bulk discounts which will reduce your overall cost of training. Better still, any courses you order can be registered to users upto two years later so there's no need to worry about training credits expiring.

Courses Purchased	Discount
10+	10%
20+	20%
50+	30%
75+	40%
100+	50%

Who is this online GDPR Awareness training for?

This course is suitable for employees at all levels who need an understanding of data protection responsibilities in the workplace, particularly those who handle, access or process personal data as part of their role. This includes staff working in customer service, HR, finance, administration, logistics, healthcare, education, retail and many other sectors where personal information is collected or managed.

The course is ideal for frontline workers, supervisors, team leaders and first-line managers who need a clear understanding of their responsibilities under UK data protection law. It is particularly beneficial for organisations looking to strengthen data protection awareness across their workforce and reduce the risk of personal data breaches.

As the training covers both individual and organisational responsibilities, it is suitable for businesses of all sizes seeking to promote good data handling practices and support compliance with UK data protection law.

Course Screenshots

Course Aim

This training aims to develop learners’ awareness of data protection law in the United Kingdom, how it applies in the workplace, and the responsibilities of organisations and individual employees when handling personal data.

The course is designed not only for those working in IT but for employees across industries and job roles that involve handling personal data lawfully, securely and with due care. Learners will gain practical knowledge of UK data protection requirements and understand how to apply them confidently within their day-to-day role.

The training is designed to help employees develop a clear understanding of what is expected of them when processing personal data and how organisational procedures and measures help support compliance. This includes recognising and promptly reporting or escalating suspected personal data breaches through the appropriate internal procedures. Learners will also gain awareness of an organisation’s responsibility to assess personal data breaches and, where notification to the ICO is required, to report them without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Learning Objectives Course Content Assessment

Learning Objectives

On completion of the course, you should be able to:

Define personal data and explain what makes it personal under UK GDPR
Identify the key legislation that governs data protection in the United Kingdom
State the role of the Information Commissioner's Office (ICO) and the sanctions it can apply
List the seven principles of UK GDPR and explain what each one means in practice
Identify the six lawful bases for processing personal data, including performance of a contract

Explain what valid consent looks like and how it must be obtained
Identify what is meant by special category data and why it requires extra protection
List the eight rights that individuals have over their personal data
Distinguish between the roles of a data controller and a data processor
Explain what is meant by privacy by design and by default
Recognise what constitutes a personal data breach and explain the 72-hour reporting obligation
State the basic rules around transferring personal data outside the UK
Identify the key responsibilities of both employers and employees in relation to data protection
explain how GDPR can be enforced by the Supervisory Authorities (SA’s) where there is non-compliance

Course Content

This course is made up of the following modules:

An Introduction in Data Protection

This section introduces the learner to the course. It looks at what is personal data and explains key terminology.
Module 1 - The Legal Framework

This section of the course concentrates on UK GDPR and the Data Protection Act 2018, how UK GDPR relates to EU GDPR, the role of the Information Commissioner Office (ICO), sanctions and penalties as well as the seven principles of UK GDPR.
Module 2 - Lawful Bases for Processing

This section of the course covers the six lawful bases, including performance of a contract. Consent, what is means and how to obtain it, Special category data and Data Subject Rights.
Module 3 - Roles and Responsibilities, Data Security and Internation Data Transfers

In this final section of the course the focus will be on Controllers and Processors, what each is and their responsibilities. Data Security recognising and reporting data breaches and International Data Transfer.

Download Course Overview (PDF)

Assessment

On completion of the course lessons and training material an online assessment will automatically unlock. The assessment will contain 15 multiple-choice questions and a mark of 75% or above will be required to pass.

The assessment will be marked instantly and so you will know straight away if you have passed or not. If you don't pass first time there's no need to worry. Unlimited resits at absolutely no additional charge are available so you can retake the assessment again as many times as you need to.

GDPR Certification

Our entire library of training courses is accredited by the CPD Certification Service as adhering to the universally recognised Continuing Professional Development (CPD) guidelines.

Upon passing the online assessment you will have the options to both print and download your GDPR Training Certificate in PDF format. In addition to this an automated email will also be sent to your chosen email address containing a link to your certificate ensuring you always have access to a copy.

Furthermore, a QR code is displayed on each certificate which when scanned by a smartphone links to our certification database. This allows employers, auditors and local authority inspectors, for example, to establish a certificates validity instantly and at any time.

Common GDPR Training Questions

UK data protection law does not prescribe a specific GDPR training course that every employee must complete. However, organisations are responsible for ensuring that staff understand their data protection responsibilities and are appropriately trained for their roles.

The Information Commissioner’s Office (ICO) expects organisations to provide data protection training for all staff, including induction and refresher training. Training should be relevant to an employee’s role and cover appropriate areas such as handling personal data, information security, recognising personal data breaches and responding to information rights requests.

For employers, providing appropriate GDPR and data protection training is therefore an important part of demonstrating accountability and helping employees handle personal data securely and in accordance with UK data protection law.

GDPR and data protection training should be refreshed regularly to ensure employees keep their knowledge up to date. While UK data protection law does not specify a fixed training frequency, the Information Commissioner’s Office (ICO) recommends providing refresher training at regular intervals.

The ICO advises that refresher training should ideally be completed annually and should not exceed two years between sessions. New employees should also receive appropriate data protection training before accessing personal data and within one month of starting their role.

Organisations should provide additional training sooner where necessary, such as when an employee requires further support, responsibilities change, or training needs to be updated to reflect changes in data protection law, organisational procedures or emerging risks.

Yes. GDPR training can be completed online, allowing employees to develop their understanding of data protection responsibilities without needing to attend classroom-based training.

Online training can provide a flexible way for organisations to deliver GDPR awareness across their workforce, allowing employees to complete training at a suitable time and location. The Information Commissioner’s Office (ICO) itself provides online data protection training resources and self-paced learning for organisations and employees.

Whatever the method of delivery, GDPR training should be appropriate to an employee’s role and provide them with the knowledge they need to handle personal data responsibly. Organisations should also ensure training remains accurate and up to date, and that employees understand the information provided.

GDPR training is important because employees play a key role in how personal data is handled and protected in the workplace. Staff may regularly collect, access, share, store or dispose of personal information, so they need to understand how to do this responsibly and in accordance with data protection requirements.

Effective training helps employees recognise data protection risks, understand their responsibilities and know what action to take if something goes wrong. This can include identifying a potential personal data breach, following internal reporting procedures and responding appropriately when individuals exercise their data protection rights.

Providing appropriate training also helps organisations demonstrate accountability and build a workplace culture in which protecting personal data is treated as an everyday responsibility rather than solely the responsibility of managers, IT teams or data protection specialists.

GDPR training can help reduce the risk of personal data breaches by teaching employees how to recognise common data protection risks and handle personal information securely during their everyday work.

Training can help employees understand the importance of checking information before sending it, using personal data only for appropriate purposes, following secure data handling procedures and being alert to situations that could result in information being lost, disclosed or accessed by someone who should not have it.

It can also help employees recognise when a personal data breach may have occurred and understand the importance of reporting it promptly through their organisation’s internal procedures. Early reporting allows the organisation to investigate the incident, take steps to limit its impact and determine whether further action, including notification to the Information Commissioner’s Office (ICO), is required.

While training cannot eliminate the possibility of a personal data breach, regularly reinforcing good data protection practices can help reduce avoidable mistakes and encourage employees to make protecting personal information part of their everyday working practices.

The Importance of GDPR Awareness in the Workplace

Employees are responsible for handling personal data carefully and following their organisation’s data protection policies and procedures.

When handling personal information, employees should:

Only access or use personal data when necessary for their role and for an appropriate work-related purpose.
Keep personal data secure by following their organisation’s approved systems, procedures and security measures.
Take care when sharing personal information, including checking recipients before sending emails, documents or other data.
Prevent unauthorised access or disclosure by ensuring personal information is not unnecessarily viewed, shared or made available to others.
Store and dispose of personal data appropriately in accordance with their organisation’s procedures.
Report suspected personal data breaches promptly through the appropriate internal reporting procedure.
Recognise and escalate requests concerning data protection rights, such as when someone asks to access their personal information.

While organisations remain responsible for complying with UK data protection law, employees play an important role in putting those requirements into practice through the way they handle personal data during their everyday work.

GDPR risks can arise whenever employees collect, access, use, share or store personal data. Many data protection incidents result from everyday mistakes or poor data-handling practices rather than deliberate misuse.

Common workplace risks include:

Sending personal data to the wrong person, such as selecting the incorrect email recipient or attaching the wrong document.
Unauthorised access to personal data, including employees viewing information they do not need for their role.
Sharing personal information inappropriately, either internally or with people outside the organisation.
Poor password and account security, which can increase the risk of unauthorised access to systems containing personal data.
Losing devices, documents or records containing personal information, particularly where they are not adequately protected.
Keeping personal data for longer than necessary instead of following appropriate retention and disposal procedures.
Failing to recognise or report a suspected personal data breach promptly, which can delay an organisation's ability to investigate and respond.

Employees can help reduce these risks by following their organisation's data protection and security procedures, handling personal information carefully and reporting concerns as soon as they become aware of them

If an employee suspects that personal data has been lost, disclosed, accessed or altered without authorisation, they should act promptly and follow their organisation's internal data breach procedures.

Employees should:

Report the incident immediately to the appropriate person or team, such as their manager, Data Protection Officer (DPO) or designated data protection contact.
Provide clear information about what happened, including what personal data may be involved, who may be affected and when the incident occurred or was discovered.
Take appropriate steps to limit further risk, where they are authorised and able to do so, such as recalling an incorrectly sent email or securing information that has been left exposed.
Preserve relevant information about the incident and avoid deleting records or evidence that may be needed during the investigation.
Follow instructions from the organisation and cooperate with any investigation or further action required.

The organisation is responsible for assessing the breach and deciding whether it needs to be reported to the Information Commissioner's Office (ICO). Where a personal data breach is likely to result in a risk to people's rights and freedoms, the organisation must notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.

Employees should therefore report suspected breaches promptly rather than trying to decide for themselves whether the incident is serious enough to notify the ICO.

Individuals have the right to ask an organisation for access to their personal data. This is commonly known as a Subject Access Request (SAR). Employees should be able to recognise a request and know how to pass it to the appropriate person or team within their organisation.

If an employee receives a request for personal data, they should:

Recognise that the request may be a Subject Access Request, even if the person does not use the words “SAR”, “subject access” or refer specifically to the UK GDPR.
Follow the organisation's internal procedure and promptly pass the request to the appropriate person or team responsible for handling data protection requests.
Record relevant details, such as when the request was received and what information the individual has asked for.
Avoid unnecessarily delaying the request, as organisations have a legal timeframe in which to respond.
Do not disclose personal data without authorisation, particularly where records may also contain information about other individuals.
Cooperate with the person handling the request if they need help locating relevant personal data or understanding where information may be held.

The organisation is responsible for assessing and responding appropriately to the request. Employees do not need to make legal decisions about whether information should be disclosed unless this forms part of their authorised role, but they should recognise a potential request and ensure it reaches the appropriate person promptly.

Employees should only access personal data when it is necessary for their role and they have an appropriate work-related reason for doing so. Having technical access to a system or record does not automatically mean an employee should view all of the personal information available within it.

Limiting access to personal data helps organisations:

Reduce the risk of unauthorised access or disclosure by ensuring information is only available to people who genuinely need it.
Protect people's privacy by preventing personal information from being viewed unnecessarily.
Support data protection principles, including data minimisation, purpose limitation, and integrity and confidentiality.
Reduce the potential impact of a data breach by limiting the number of people who can access sensitive or confidential information.
Maintain appropriate access controls so that employees have access to the information required for their responsibilities without unnecessary permissions.

Employees should therefore use personal data only for legitimate work-related purposes and follow their organisation's policies and access controls. Personal information should not be accessed simply out of curiosity or because an employee has the ability to view it.

Workplace Scenario

1 / 4

Personal Data Sent to the Wrong Person Situation

Situation

An employee needs to email a document containing customer information to a colleague. When entering the recipient's name, they accidentally select a different contact with a similar name and send the email without checking the address.

What went wrong?

Personal data has been disclosed to someone who was not intended to receive it. The employee should report the incident promptly through their organisation's internal data breach procedure rather than attempting to deal with it themselves or assuming the mistake is insignificant.

Key takeaway

Always check recipients and attachments before sending personal information. If personal data is sent to the wrong person, report it promptly so the organisation can assess the incident and take appropriate action.

Workplace Scenario

Unnecessary Access to Personal Data

Situation

An employee has access to a system containing customer records. Out of curiosity, they open the record of someone they know, even though they have no work-related reason to view the information

What went wrong?

Having access to a system does not mean an employee is authorised to view every record it contains. Personal data should only be accessed when there is an appropriate reason connected with the employee's role.

Key takeaway

Only access personal data when you need it to carry out your work. Never view someone's information simply because you have the ability to access it.

Workplace Scenario

An Informal Request for Personal Data Situation

Situation

A customer contacts an employee and says, “Can you send me a copy of all the information you hold about me?” The employee does not recognise this as a potential data protection request because the customer does not mention GDPR or use the term “Subject Access Request”.

What went wrong?

A request does not have to mention GDPR or use specific wording to potentially exercise the individual's right of access. The employee should recognise the request and follow their organisation's procedure for passing it to the appropriate person or team.

Key takeaway

Employees should know how to recognise a potential request for personal data and escalate it promptly, even when the individual makes the request informally.

Workplace Scenario

A Suspected Data Breach Is Not Reported

Situation

An employee discovers that a document containing personal information has been left somewhere it may have been viewed by unauthorised people. They retrieve the document and decide not to report the incident because no one appears to have complained..

What went wrong?

The employee has made their own judgement that the incident is not serious enough to report. Suspected personal data breaches should be reported through the organisation's internal procedures so that the appropriate person can assess the risk and determine what action is required.

Key takeaway

Do not ignore or conceal a suspected personal data breach because it appears minor. Report it promptly and allow the organisation to assess what happened and decide what needs to happen next..

Course Reviews

4.6.

(138 reviews)

Related Online Training Courses

Cyber Security Awareness Training

£25.00 +VAT

We are all responsible for keeping information and systems as safe as possible, as access to the internet is vital to our everyday modern life. Becoming vigilant on your computer and smartphone is a first step to preventing a possible cyber threat..

Learn More
Anti-Bribery

£25.00 +VAT

Bribery is an offence, but sometimes actions taken without intending harm, could be regarded as bribery. Understanding what could be regarded as bribery may save company officers much heartache and money. This course is an excellent overview of the Act and will help companies stay away from prosecution.

Learn More

Call Us 01482 861 040